Drop the extension, and give the test suite a front door

Phase 6, the last of the fresh-install spec.

159 scripts lose their .sh: 110 contracts, 47 Vicinae commands, 2 compositor
contracts. A shebang and the executable bit already select the interpreter. The
extension only ever added something that had to stay in sync, and the rename
proved the point twice over in the space of an hour.

The spec's stated risk was Vicinae's script discovery. One script was renamed and
reloaded on its own before the other 46 followed; it came back as
scripts:panama.capture and all 47 resolve. What the probe turned up instead is
that the extension was never only a filename: Vicinae's command IDs embed it, so
every ID changed. Nothing in this repository refers to them, so nothing breaks.
The only trace is Vicinae's metadata.json, whose visited map had two Panama
entries that are now orphaned -- two commands lost their usage ranking and will
earn it back. Worth knowing before anyone renames these again on a machine that
has a keybind pointing at one.

Rewriting the references by exact filename missed two things it structurally
could not see: a name built from a variable, settings-$page.sh, and a glob,
-name '*.sh'. Both were in the contract that counts the generated commands, which
promptly reported 47 expected and 0 found. The mechanical part of a rename is the
part that looks finished.

The three subcommands. panama doctor fronts a health check that already existed
and already ran at the end of every install but could not be reached from a
terminal. panama upgrade re-runs the installer from anywhere. panama test runs
the suite, which had no entry point at all -- 121 files that were the main safety
net in this repository and were invisible in it.

Writing that runner found three tests nothing was running.
calendar_agenda_bridge_test, home_assistant_bridge_test and kdeconnect_bridge_test
are unittest suites without the executable bit, so no contract invoked them and
the first draft of the runner skipped them silently. All three pass, and have
passed unobserved for weeks. The runner collects *_test.py as well now, because a
runner with a blind spot is worse than no runner for the same reason a dependency
checker with one is: it reports PASS.

Six worktrees pruned. Each was re-checked rather than trusted to the spec's list,
and two needed it: panama-commands is not on feat/panama-commands but on
feat/gnome-tweaks-parity, and fix/panama-displays-review reads [ahead 3] -- ahead
of its remote, not of main, with every commit patch-equivalent to landed work.
roadmap-completion stays; it has five commits that are genuinely unlanded. The
branches are left alone: pruning a worktree costs nothing, deleting a branch is a
decision.

121 contracts pass.

Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj

tests/quickshell/updates-contract

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+
+# Updates come from three places that fail independently, and the page must not
+# claim to know more than it checked.
+#
+# The rules:
+#
+#   1. Every status a health check can return must be one the doctor counts.
+#      "degraded" is not in its vocabulary; a check returning it was counted as
+#      nothing at all while the summary still said healthy. That is the silent
+#      no-op this whole codebase keeps relearning.
+#   2. A count nobody verified is not a count. "Up to date" may only be said
+#      after a check actually ran.
+#   3. Applying packages takes a restore point first, and a failure to take one
+#      must not block the update.
+#   4. Checking is separate from opening. A nine-second scan on every page open
+#      would make Settings feel broken.
+#
+# Read-only: it reads update state and never installs anything.
+
+set -uo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+helper="$repo_dir/config/dot/quickshell/scripts/panama-updates"
+service="$repo_dir/config/dot/quickshell/services/Updates.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/UpdatesPage.qml"
+doctor="$repo_dir/config/dot/quickshell/scripts/panama-doctor"
+
+fail() {
+    printf 'updates contract: %s\n' "$1" >&2
+    exit 1
+}
+
+for path in "$helper" "$service" "$page" "$doctor"; do
+    [[ -r "$path" ]] || fail "missing $path"
+done
+[[ -x "$helper" ]] || fail 'panama-updates is not executable'
+
+# ── 1. Every health status is one the doctor counts ─────────────────────────
+statuses="$(sed -n 's/^Status = Literal\[\(.*\)\]$/\1/p' "$doctor" | tr -d '" ' | tr ',' '\n' | grep -v '^$')"
+[[ -n "$statuses" ]] || fail 'could not read the doctor status vocabulary'
+while read -r used; do
+    [[ -n "$used" ]] || continue
+    grep -qx "$used" <<<"$statuses" \
+        || fail "a check reports status \"$used\", which the doctor does not count -- it would be invisible in the summary"
+done < <(grep -oE 'Check\("[a-z.]+", "[a-z-]+", "[^"]+", "[a-z]+"' "$doctor" \
+         | sed -E 's/.*, "([a-z]+)"$/\1/' | sort -u)
+
+# ── 2. No confident answer without a check ──────────────────────────────────
+grep -q 'everChecked' "$service" \
+    || fail 'the service cannot tell "no updates" from "never looked"'
+grep -q 'Not checked yet' "$service" \
+    || fail 'a machine that has never checked is reported as up to date'
+
+# ── 3. Packages get a restore point, best effort ────────────────────────────
+apply_body="$(sed -n '/^def apply/,/^def /p' "$helper")"
+grep -q 'take_restore_point' <<<"$apply_body" \
+    || fail 'installing packages does not take a snapshot first'
+restore_body="$(sed -n '/^def take_restore_point/,/^def /p' "$helper")"
+grep -q 'return ""' <<<"$restore_body" \
+    || fail 'a failed snapshot has no non-fatal path, so it would block the update'
+grep -qE 'raise BoundaryError' <<<"$restore_body" \
+    && fail 'a failed snapshot aborts the update, which is worse than an update without a restore point'
+
+# Firmware and applications must NOT take a system snapshot: neither changes
+# the system tree, and a restore point that restores nothing is noise.
+grep -qE 'take_restore_point.*firmware|firmware.*take_restore_point' <<<"$apply_body" \
+    && fail 'firmware updates take a system snapshot, which would restore nothing'
+
+# ── 4. Opening is not checking ──────────────────────────────────────────────
+grep -q 'def snapshot' "$helper" || fail 'there is no cheap read'
+snapshot_body="$(sed -n '/^def snapshot/,/^def /p' "$helper")"
+grep -qE 'dnf_updates\(\)|flatpak_updates\(\)|firmware_updates\(\)' <<<"$snapshot_body" \
+    && fail 'the cheap read runs the expensive scan, so every page open would wait on the network'
+grep -q 'read_cache()' <<<"$snapshot_body" \
+    || fail 'the cheap read does not use the cached result'
+
+command -v jq >/dev/null 2>&1 || { printf 'updates contract: SKIP (no jq)\n'; exit 0; }
+
+# ── The snapshot is fast and complete ───────────────────────────────────────
+started="$(date +%s)"
+state="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'
+elapsed=$(( $(date +%s) - started ))
+(( elapsed <= 5 )) || fail "the cheap read took ${elapsed}s; it is supposed to be instant"
+
+jq -e '(.dnf | type == "object") and (.flatpak | type == "object") and (.firmware | type == "object")' \
+    <<<"$state" >/dev/null || fail 'the snapshot is missing one of the three sources'
+jq -e '.kernel | has("running") and has("newestInstalled") and has("rebootNeeded")' <<<"$state" >/dev/null \
+    || fail 'the kernel state is incomplete'
+jq -e '.automatic | has("flatpakEnabled")' <<<"$state" >/dev/null \
+    || fail 'automatic update state is missing'
+
+# The reboot signal must be derived, not guessed.
+jq -e '.kernel.rebootNeeded == (.kernel.running != .kernel.newestInstalled)' <<<"$state" >/dev/null \
+    || fail 'the reboot signal does not follow from the running and installed kernels'
+
+# ── Refusals ────────────────────────────────────────────────────────────────
+[[ -n "$("$helper" apply nonsense 2>/dev/null | jq -r '.error // ""')" ]] \
+    || fail 'an unknown update source was accepted'
+[[ -n "$("$helper" bogus 2>/dev/null | jq -r '.error // ""')" ]] \
+    || fail 'an unknown command was accepted'
+
+
+# ── Update history ──────────────────────────────────────────────────────────
+#
+# Worth showing because automatic updates leave no other trace: something that
+# installed itself overnight is invisible until somebody looks here.
+#
+# Both sources are asked in their own machine-readable form. flatpak's is the
+# awkward one -- it prints a JSON array whose timestamps are "Aug 20 08:07:46",
+# with no year -- so the year is inferred, and a date that would land in the
+# future is read as last year's. dnf's start_time is epoch UTC; its own table
+# prints that value as though it were local, which it is not.
+
+history="$("$helper" history)" || fail 'history failed'
+printf '%s' "$history" | python3 -c "
+import json, sys, time
+payload = json.load(sys.stdin)
+entries = payload['entries']
+if not entries:
+    raise SystemExit(0)   # a machine with no transactions is legitimate
+
+now = int(time.time())
+previous = None
+for entry in entries:
+    if entry['source'] not in ('dnf', 'flatpak'):
+        raise SystemExit(f\"unknown source {entry['source']}\")
+    at = int(entry['at'])
+    if at and at > now + 86400:
+        raise SystemExit(f\"{entry['summary']} is dated in the future, so the year was read wrong\")
+    if at and previous is not None and at > previous:
+        raise SystemExit('entries are not newest first')
+    if at:
+        previous = at
+    if not str(entry['summary']).strip():
+        raise SystemExit('an entry has nothing to say it did')
+if not any(e['source'] == 'flatpak' for e in entries) and not any(e['source'] == 'dnf' for e in entries):
+    raise SystemExit('neither source produced anything, so nothing was parsed')
+" || fail 'the update history is not usable'
+
+printf 'updates contract: PASS (%s dnf, %s flatpak, %s firmware; reboot needed: %s)\n' \
+    "$(jq -r '.dnf.count // 0' <<<"$state")" \
+    "$(jq -r '.flatpak.count // 0' <<<"$state")" \
+    "$(jq -r '.firmware.count // 0' <<<"$state")" \
+    "$(jq -r '.kernel.rebootNeeded' <<<"$state")"